How do you map sensitive customer information for Reg S-P?

If your firm cannot say which systems hold clients' Social Security numbers, account numbers and login details, a Reg S-P incident starts with a hunt for that data while the 30-day notice clock runs. For CCOs and COOs at RIAs, broker-dealers and dual-registered firms, a current map of sensitive customer information is the record that lets you scope an incident quickly and show an examiner your policies are in practice.

What does Reg S-P require you to know about where customer information lives?

Reg S-P never uses the term "data map." Its incident response requirement still assumes you have one. Under 17 CFR 248.30(a)(3)(i), a firm's response program must include procedures to assess the nature and scope of an incident and to "identify the customer information systems and types of customer information that may have been accessed or used without authorization." A firm that has not listed its systems in advance has to build that list during an incident, while the notice clock runs.

Both compliance dates have passed: December 3, 2025 for larger entities and June 3, 2026 for smaller entities, according to the SEC's small entity compliance guide. In its fiscal year 2026 examination priorities, the Division of Examinations said that after those dates it "will examine whether firms have developed, implemented, and maintained policies and procedures in accordance with the rule's new provisions." For what examiners have requested so far, see what SEC examiners are asking for on Reg S-P.

What counts as customer information and a customer information system?

Both definitions are broad. Customer information is "any record containing nonpublic personal information about a customer of a financial institution," in any form, held by the firm or on its behalf. That reaches records about another institution's customers that you hold, such as account data received from a custodian or a client's prior adviser.

Customer information systems are "the information resources owned or used by a covered institution" that are organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of customer information, per 17 CFR 248.30(d)(6). The words "or used" matter. A CRM you license, a custodian portal your staff log into, and a vendor's file share all qualify.

Why does the map decide how many people you notify?

A firm that cannot pinpoint the affected individuals must notify everyone whose sensitive customer information sits in the affected system. Under 17 CFR 248.30(a)(4)(ii), when a firm "is unable to identify which specific individuals' sensitive customer information" was accessed or used without authorization, it "must provide notice to all individuals whose sensitive customer information resides in the customer information system" involved. The rule excuses individuals the firm reasonably determines were not affected.

Notice is due "as soon as practicable, but not later than 30 days" after the firm becomes aware of the incident. A map that shows which data sits in which system, and whose data it is, is what lets a firm narrow the group and support that narrowing in writing. Without one, a compromise of a single shared mailbox can become a notice to every client.

Which sensitive customer information elements should the map track?

Track the elements the rule treats as sensitive customer information, because those drive notification. Section 248.30(d)(9)(ii) lists examples:

• Identifiers such as Social Security numbers, driver's license or passport numbers, and employer or taxpayer identification numbers.
• Biometric records.
• Unique electronic identification numbers, addresses or routing codes.
• An account number, name or online user name combined with authenticating information, such as an access code, a security question and answer, a partial Social Security number, or a date of birth.

For each system, record which of these elements are present, roughly how many individuals they cover, and whether the data includes other institutions' customers.

Where does sensitive customer information usually hide?

Most firms find it well outside the systems they think of as client databases. Common locations include:

• Email, including attachments clients send and shared mailboxes used by operations staff.
• File shares and cloud storage such as OneDrive, SharePoint and Dropbox, especially scanned account forms and tax documents.
• CRM, financial planning and portfolio accounting platforms.
• Custodian and clearing portals, and the reports staff download from them.
• E-signature, document collection and client portal tools.
• Call recordings, meeting transcripts and AI notetaker output.
• Backups, archives and the email archiving service used for books and records.
• Laptops, phones, and the scanners and printers that cache documents.
• Departed employees' mailboxes and drives kept for retention.

Every system a vendor maintains also falls under the service provider provisions of 17 CFR 248.30(a)(5), which require oversight of service providers, including their notice to you within 72 hours of a breach affecting a customer information system they maintain. The map tells you which vendors those are. Our guide to updating vendor contracts for the 72-hour notice covers the contract side.

What should each entry in the map include?

Each entry should let an incident responder answer four questions quickly: what data, whose data, who can reach it, and who runs it. A practical entry records:

• System name, the internal owner, and the vendor if there is one.
• Data elements present, using the categories in section 248.30(d)(9).
• Approximate record counts, and whether other institutions' customers are included.
• Who has access, including vendor staff and service accounts.
• Where logs are kept and for how long, since logs are how you show what was or was not accessed.
• Retention and disposal practice, since section 248.30(b) requires firms to properly dispose of consumer information and customer information and to adopt written disposal policies and procedures.
• The contract clause that covers the 72-hour service provider notice.

How do you keep the map current?

Tie updates to events the firm already tracks, then review the full map at least once a year. Add a map update step to vendor onboarding, new software requests and staff offboarding, so systems and access are recorded when they change. A practical time for the full review is alongside your annual review of the incident response program.

Keep each dated version. Advisers must keep Reg S-P policies and procedures under Rule 204-2(a)(25), and broker-dealers under Rule 17a-4(e)(14). A dated map sitting next to those policies shows an examiner that the policies are implemented, which is what the Division said it will look for. Our Reg S-P recordkeeping guide lists the required records and retention periods.

What should your firm do this quarter?

• Pull a list of every application and vendor from billing records, your single sign-on portal and expense reports. Anything the firm pays for or signs into is a candidate system.
• Run a discovery scan for Social Security numbers and account numbers across email, file shares and cloud storage. Microsoft Purview and similar tools can do this inside Microsoft 365.
• Fill in the entry fields above for each system, and confirm logging is turned on and retained long enough to investigate an incident.
• Match each vendor system to a signed contract that includes the 72-hour notice term.
• Run one tabletop exercise against the map: pick a system, assume it was breached, and time how long the team takes to name the affected individuals.

How can s90 help keep the map current?

s90 builds and maintains the system inventory as part of managing a firm's technology, so the map stays current as vendors and staff change. Our agreements commit us to notify clients within 72 hours of a breach affecting systems we manage and to produce evidence within 24 hours of a request, which supports both the service provider provisions and exam document requests. If you would like a second look at your map before your next exam, we are glad to talk.